OpenHuman accepts metadata from external MCP servers and inserts values such as names, titles, and descriptions directly into the internal LLM prompt. The payloads are not sanitized or bounded, so an attacker who controls or compromises an MCP server can supply a crafted description that contains LLM instructions. On each agent turn those instructions are evaluated, allowing the model to execute arbitrary tool calls, harvest data or perform actions that would normally be protected by user prompts. Because the agent trusts the server payload, the malicious instructions can bypass normal safety checks, leading to remote code execution or data exfiltration.

Users running TinyhumansAI OpenHuman before version 0.57.13 are affected, including the desktop application and the Rust library used as an SDK. The issue manifests whenever an MCP server that is under attacker control or compromised is registered with the agent. Both single-user setups and multi-user deployments that rely on external MCP services fall into this scope. The fix was released in OpenHuman 0.57.13, which sanitizes server‑provided descriptions.

The CVSS score of 8.3 classifies this as a high‑severity vulnerability with potential for remote code execution. EPSS is not available, so a concrete exploitation probability cannot be quantified, but the lack of KEV listing suggests no widespread exploitation yet. The attack requires that the attacker can host or subvert an MCP server, which is feasible in many environments that interface with third‑party MCP providers. Once the server is compromised, the malicious description is processed on every agent cycle, making exploitation trivial for the attacker. Immediate remediation is therefore essential.